# DC9 TLS front door

HAProxy inspects TCP SNI without terminating TLS:

- `dc9-tls-e2f48b.opfo.xyz` -> managed sing-box Trojan on host TCP 22591
- `sb-dd65a3.kais.cloud` -> managed sing-box AnyTLS on host TCP 43824
- `dc9.kais.cloud` -> the existing Arcane Agent Caddy on `arcane_default`
- unmatched SNI -> the dedicated Caddy fallback serving `dc9.opfo.xyz`

HAProxy publishes host TCP 443. The existing Arcane Agent Caddy remains attached
to `arcane_default` without a host TCP 443 binding and receives
`dc9.kais.cloud` traffic from HAProxy.